SA-CONTRIB-2026-243: Critical severity drupal/media_bulk_upload vulnerability

Q: Who can exploit this issue?

An attacker must have a role granted the "bulk upload form" permission. The issue applies when the bulk upload form is configured for a media type that the user is not otherwise permitted to create.

Q: What permissions should be reviewed while assessing exposure?

Review which roles have the "bulk upload form" permission and which media types are configured on the bulk upload form. Users with that permission may be able to create configured media types without the expected per-type creation permission checks.

Published Oct 21, 2026

Updated

This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "bulk upload form".

Credit

Stuart Rowlands (stooit)

Affected Software

1 affected componentFixes available

drupal/media_bulk_upload<3.0.6

3.0.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/media_bulk_upload to a version that resolves this vulnerability.
Fixed in 3.0.6

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114544

Frequently Asked Questions

Who can exploit this issue?

An attacker must have a role granted the "bulk upload form" permission. The issue applies when the bulk upload form is configured for a media type that the user is not otherwise permitted to create.

What permissions should be reviewed while assessing exposure?

Review which roles have the "bulk upload form" permission and which media types are configured on the bulk upload form. Users with that permission may be able to create configured media types without the expected per-type creation permission checks.

SA-CONTRIB-2026-243: Critical severity drupal/media_bulk_upload vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What permissions should be reviewed while assessing exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What permissions should be reviewed while assessing exposure?